Skip to main content
NEW: Knox IL5 Landing Zone. Meet the DoW's most critical missions in 180 days.
Knox CVE Database
/
CVE-2026-42271
High
8.8

CVE-2026-42271: BerriAI LiteLLM Command Injection Vulnerability

BerriAI LiteLLM contains a command injection vulnerability that could allow any authenticated user, including holders of low-privilege internal-user keys, to run arbitrary commands on the host.

Added to the CISA KEV catalog:
June 8, 2026

Overview

LiteLLM, an AI gateway proxy for routing requests to large language model APIs, contains a command injection flaw in two MCP server test endpoints. Any user holding a valid API key, including low-privilege internal-user keys, can send a crafted request that causes the proxy to spawn an arbitrary OS command on the host. Versions from 1.74.2 up to 1.83.7 are affected, as is Red Hat OpenShift AI in several release lines that bundle the vulnerable component.

Vulnerability details

Affected vendor
BerriAI
Affected product
LiteLLM
Weakness type (CWE)
CWE-78, CWE-77

The two affected endpoints, POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list, were designed to preview a Model Context Protocol server configuration before it was saved. They accepted a full stdio-transport configuration in the request body, including the command, args, and env fields. When the proxy received a stdio-type configuration, it attempted to establish a connection by spawning the caller-supplied command as a subprocess, inheriting the privileges of the proxy process. No validation or sanitization was applied to the command field, and no role check was enforced beyond confirming that the request carried a valid API key. This is a textbook OS command injection flaw (CWE-78): attacker-controlled data flows directly into a process-creation call without any trust boundary enforcement.

An attacker who holds any valid LiteLLM proxy API key, including a low-privilege internal-user key, can send a POST request to either vulnerable endpoint with a crafted stdio-transport body specifying an arbitrary command and arguments. The proxy spawns that command as a subprocess on the host, giving the attacker code execution at the privilege level of the proxy process. The result is full confidentiality, integrity, and availability impact on the host. The only preconditions are possession of a valid API key and network access to the proxy endpoints, both of which are realistic for any authenticated user of the gateway.

Severity and impact

8.8
High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality impact
High
Integrity impact
High
Availability impact
High

Exploitation status

This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

Known ransomware campaign use
Unknown

Detection and monitoring

  • Monitor proxy access logs for POST requests to /mcp-rest/test/connection or /mcp-rest/test/tools/list originating from accounts that are not administrators or MCP configuration owners; these endpoints have no legitimate use by low-privilege internal-user keys.
  • Audit subprocess creation events on the proxy host (e.g., via auditd or EDR process telemetry) for child processes spawned by the LiteLLM proxy process with parent-child relationships that do not match expected model-routing or health-check activity, particularly shells or system utilities.
  • Review API key usage logs for internal-user keys that have called either MCP test endpoint; routine low-privilege usage of these endpoints is not expected and warrants investigation.

Remediation

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Federal (FCEB) remediation due date
June 22, 2026

Additional hardening

  • Upgrade LiteLLM to version 1.83.7 or later; for Red Hat OpenShift AI, upgrade to 2.25.8 or later on the 2.25 line, or 3.3.4 or later on the 3.3 line. Consult the vendor advisory in References for additional affected builds.
  • Restrict network access to the LiteLLM proxy API to trusted networks or authenticated internal users only; placing the proxy behind a network boundary reduces the pool of principals who can supply a valid API key.
  • Audit all existing proxy API keys and revoke any internal-user keys that do not require access to MCP configuration endpoints; reducing the number of valid keys limits the attack surface while a patch is applied.
  • Run the LiteLLM proxy process under a dedicated, least-privilege OS account with no write access outside its working directory, so that any command injected via this flaw executes with minimal host privileges.

Key dates

Published (NVD)
May 8, 2026
Added to CISA KEV
June 8, 2026
Remediation deadline
June 22, 2026
Last updated
July 14, 2026

References

Frequently asked questions

Does CVE-2026-42271 affect my FedRAMP authorization?

If BerriAI LiteLLM runs inside your authorization boundary, yes. CVE-2026-42271 appears in CISA's Known Exploited Vulnerabilities (KEV) catalog, and its remediation deadline of June 22, 2026 has already passed. An unpatched KEV inside a FedRAMP boundary is an assessor finding; an overdue one is visible to both your assessor and your sponsoring agency now. At this point, you either remediate it or formally document the mitigation and the delay.

How does Knox help me handle CVE-2026-42271?

Knox does not patch your software. Remediating BerriAI LiteLLM is your responsibility under the FedRAMP shared-responsibility model. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, plus continuous compliance monitoring and audit-artifact coverage to document the fix for your next assessment. Applying the patch is yours to own; managing your compliance posture while you do it is not something you have to handle on your own.

How does Knox's monitoring help with vulnerabilities like this?

Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues on an ongoing basis. For a CVE like CVE-2026-42271, that means exposure surfaces during continuous monitoring rather than waiting for an assessor to flag it at a scheduled review.

How do I get FedRAMP authorized with Knox?

Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.

CVE-2026-42271's remediation deadline of June 22, 2026 has passed. What happens now?

An unremediated CVE-2026-42271 is already a Plan of Action and Milestones (POA&M) item. A growing POA&M list is precisely what turns a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Closing it out now and documenting why the deadline was missed is what keeps your authorization clean and the agency relationship intact.

Ready to achieve FedRAMP authorization in 90 days or less?

Schedule a meeting to discuss scope, parse readiness, and map your company’s accelerated path to FedRAMP authorization.